On 2 December 2016 at 10:29, Lu Baolu <baolu...@linux.intel.com> wrote:
> handle_cmd_completion() frees a command structure which might
> be still referenced by xhci->current_cmd. This might cause
> problem when xhci->current_cmd is accessed after that.
>
> A real-life case could be like this. The host takes a very long
> time to respond to a command, and the command timer is fired at
> the same time when the command completion event arrives. The
> command completion handler frees xhci->current_cmd before the
> timer function can grab xhci->lock. Afterward, timer function
> grabs the lock and go ahead with checking and setting members
> of xhci->current_cmd.
>
> Cc: <sta...@vger.kernel.org> # v3.16+
> Signed-off-by: Lu Baolu <baolu...@linux.intel.com>